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Claim Rejections - 35 USC § 102 

\ The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
fomn the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the International application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1-12, 18, 20-23, and 25-30 and 32-42 are rejected under 35 
U.S.C. 102(e) as being anticipated by O'Flaherty et al. (US 6,253,203). 

As per claims 1 , 27 and 34, O'Flaherty et al. discloses a method of managing 
access by a client to user-specific information maintained in connection with a plurality 
of services offered by a web-services provider; A plurality of services is inherent to the 
data view suite (Figure 1 items 102, 108) and allows for many services and profiles (Col 
7 lines 1-15, Figure 2A) and used by a user of said plurality of services; It is referred to 
the owner of the data (Col 4 lines 54-56, Figure 1 item 124) the method comprising: 

maintaining a plurality of items user-specific information in more than one of the 
plurality of services; (Col 7 lines 1-15) 

obtaining a plurality of client access requests directed to accessing the 
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plurality of items of user-specific information maintained in the more than one of the 
plurality of services; System allows for a plurality of requests from a client. (Col 1 1 lines 
28-32, Col 1 3 lines 50-55, Figure 1 items 110,112) 

said plurality of access requests being translated from a task request that 
requires the client to access the plurality of items of user-specific information in order to 
complete the task request; (Col 6 line 39-42, Col 1 1 lines 32-36, Col 13 lines 50-54) 

invoking a consent management system if the client lacks consent to 
access one of the plurality of items of user-specific information required by the client to 
complete the task request; It provides the means to invoke the consent management 
system because the user has control to update or change preferences via a client 
interface module and allows to monitor the use of personal data and send receive 
alerts. (Col 4 lines 34-41 , Col 5 lines 45-55, Col 1 1 lines 36-38, Col 4 lines 54-67, Col 5 
lines 1-2, Figure 1 items 102, 114, 116, 122) 

said consent management system selectively obtaining consent for the 
client to access the one of the plurality of items of user-specific information for which the 
client lacked consent to access; and (Col 5 lines 10-21, Col 7 lines 28-35) 

filling the plurality of client access requests if the client has permission to 
access each of the plurality of items of user-specific information in the more than one of 
the plurality of services (Col 4 lines 30-34. Col 1 1 lines 32-36. Col 1 1 lines 51-59, 
Figure 1 item 108) 
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As per claim 2, OTIaherty et al. discloses the method of claim 1 further 
comprising: 

initiating the task request requiring the client to access the plurality of items of 
user-specific information in order to complete the task request; (Col 1 1 lines 28-32) and 
translating the task request into the plurality of client access requests to complete 
the task request. (Col 6 line 39-42, Col 11 lines 32-36, Col 13 lines 50-54) 

As per claim 3, O'Flaherty et al. discloses the method of claim 2 wherein 
selectively obtaining consent for the client to access the one of the plurality of items of 
user-specific information comprises: 

identifying the task request, (Col 10 lines 57-63, Col 11 lines 29-32) 
placing the identified task request in a task queue; (Col 1 1 lines 38-43, Figure 4 
item 402) 

identifying a party with authority to grant consent to the client to access the one 
of the plurality of items of user-specific information for which the client lacked 
consent to access; (Col 5 lines 26-30) and 

displaying a consent menu to the identified party with authority, said consent 
menu prompting the identified party to grant or deny consent for the client to 
access the one of the plurality of items of user-specific information for which the client 
lacked consent to access. (Col 5 lines 10-21, Col 7 lines 28-35, Col 1 1 lines 36-37, 
Figure 1 item 122) 
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As per claims 4 and 28, O'Flaherty et al. discloses the method of 3 wherein the 
identified party with authority to grant consent is the user of the plurality of services 
offered by the web-services provider and wherein displaying the consent menu to the 
identified party comprises displaying the consent menu to the user. (Col 4 lines 54-56, 
Col 5 lines 10-21 , Figure 1 item 124) 

As per claims 5 and 29, O'Flaherty et al. discloses the method of claim 3 wherein 
the identified party with authority to grant consent is an owner of the one of the plurality 
of items of user-specific information for which the client lacked consent to access and 
wherein displaying the consent menu to the identified party comprises displaying the 
consent menu to the owner; The client is an owner of the information. (Col 4 lines 54- 
56, Col 5 lines 10-21, Col 11 lines 36-37, Figure 1 item 124) 

As per claim 6, O'Flaherty et al. discloses the method of claim 5 wherein the 
owner is the user of the plurality of services and wherein displaying the consent menu to 
the identified party comprises displaying the consent menu to the user; The consumer is 
the owner of the personal data. (Col 4 lines 54-56, Figure 1 item 124) 

As per claims 7 and 30, O'Flaherty et al. discloses the method of claim 3 wherein 
the user of the plurality of services is a managed user and the identified party with 
authority to grant consent is a manager of the managed user and wherein displaying the 
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consent menu to the identified party comprises displaying the consent menu to the 
manager of the managed user. (Col 1 1 lines 60-63) 

As per claim 8, O'Flaherty et al. discloses the method of claim 3 wherein 
displaying the consent menu to the identified party comprises: 
displaying an indication of the one of the plurality of items of user-specific information 
for which the client lacked consent to access; (Col 5 lines 49-52) 

As per claim 9, O'Flaherty et al. discloses the method of claim 8 wherein 
displaying a consent menu to the identified party further comprises displaying a method 
of access requested by the client to complete the initiated task request; The method of 
access in this case is a read/write. (Col 5 lines 49-54) 

As per claim 10, O'Flaherty et al. discloses the method of claim 8 wherein 
displaying a consent menu to the identified party further comprises displaying an 
indication of a status of each of the plurality of client access requests translated from 
the task request. (Col 1 1 lines 32-34, Figure 1 item 108) 

As per claim 1 1 , O'Flaherty et al. discloses the method of claim 10 wherein 
displaying an indication of the status of each of the plurality of client access requests 
comprises displaying an indication of whether the client has consent from the identified 
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party to access the plurality of items of user-specific information in the more than one of 
the plurality of services. (Col 11 lines 65-67, Col 12 lines 10-14, Figure 1 item 114) 

As per claim 12, OTIaherty et al. discloses the method of claim 3 wherein 
identifying the task request comprises: 

transmitting a task identifier to the consent management system, said task 
identifier identifying the plurality of client access requests to complete the task request, 
and identifying the one of the plurality of items of user-specific information for which 
the client lacked consent to access. (Col 1 1 lines 36-43, Col 13 lines 49-54) 

As per claims 18 and 32, O'Flaherty et al. discloses the method of claim 3 
wherein selectively obtaining consent for the client to access the one of the plurality of 
items of user-specific information farther comprises sending an alert message to the 
party with authority to grant consent, said alert message alerting the party with authority 
to grant consent that the client seeks access to the one of the plurality of items of user- 
specific information for which the client lacked consent. (Col 4 lines 34-41, Col 5 lines 
45-55, Col 11 lines 36-38, Col 4 lines 54-67, Col 5 lines 1-2, Figure 1 items 102, 114, 
116,122) 

As per claims 21 and 39-40, OTIaherty et al. discloses a task-based method of 
managing consent transactions in a network computing environment, said network 
computing environment including a web-services provider providing a first service and a 
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second service; The second service Is inherent to the data view suite (Figure 1 items 
102, 108) and allows for many services and profiles (Col 7 lines 1-15, Figure 2A) a user 
of the first service and the second service; It is referred to the owner of the data (Col 4 
lines 54-56, Figure 1 item 124) and a client of the web-services provider, one who 
attempts to access the data (Figure 1 items 1 10, 1 12) the method comprising: 

maintaining a first data store of user-specific information in connection with the 
first service; (Col 14 lines 27-30. Col 3 lines 65-67) 

maintaining a second data store of user-specific information in connection with 
the second service; (Col 14 lines 30-32, Col 3 lines 65-67) 

obtaining a first access request from the client and directed to the first service, 
said first access request indicating a first item of user-specific infomnation maintained in 
the first data store to which the client seeks access in order to complete a task request; 
(Col 1 1 lines 28-32, Col 7 lines 1-1 5, Figure 2A) 

obtaining a second access request from the client and directed to the second 
service, said second access request indicating a second item of user-specific 
information maintained in the second data store to which the client seeks access in 
order to complete the task request; A second request is inherent because it allows for a 
plurality of requests from a client. (Col 1 1 lines 28-32, Col 13 lines 50-55, Figure 1 
items 110, 112) 

determining if the client has consent to access the first item of user-specific 
information and the second item of user-specific information; (Col 4 lines 30-34, Col 1 1 
lines 51-59, Figure 1 item 108) 
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. invoking a consent management system if it is determined that consent does not 
currently exist to allow the client to access the first item of user-specific information; 
It provides the means to invoke the consent management system because the user has 
control to update or change preferences via a client interface module and allows to to 
monitor the use of personal data and receive alerts. (Col 4 lines 34-41 , Col 5 lines 45- 
55, Col 11 lines 36-38, Col 4 lines 54-67, Col 5 lines 1-2, Figure 1 items 102, 114, 116, 
122) said consent management system conducting a consent management transaction 
comprising: 

identifying a party with authority to grant consent to the client to access 
the first item of user-specific information; and (Col 5 lines 26-30) 

displaying a consent menu to the identified party with authority, said consent 
menu prompting the identified party to grant or deny consent to the client to access the 
first item of user-specific information. (Col 5 lines 10-21, Col 7 lines 28-35. Figure 1 
item 122) 

As per claim 22, O'Flaherty et al. discloses the method of claim 21 further 
comprising: 

initiating a task request from the user that requires the client to access the first 
item of user-specific information and the second item of user-specific information; (Col 
1 1 lines 28-32) and translating the task request into the first access request and the 
second access request. (Col 6 line 39-42, Col 1 1 lines 32-36, Col 13 lines 50-54) 
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As per claim 23, O'Flaherty et al. discloses the method of claim 21 wherein 
invoking the consent management system further comprises identifying the tasl< request 
and wherein conducting a consent management transaction further comprises: 
retrieving a task manifest corresponding to the task request, said task manifest 
identifying the first and second items of user-specific information; and 
preparing an entry for display on th,e consent menu based on the task manifest. (Col 7 
lines 65-67, Col 8 lines 1-4, Col 10 lines 57-63, Col 11 lines 29-32, Figure 1 item 108) 

As per claims 20, 25 and 33, O'Flaherty et al. discloses one or more computer- 
readable media having computer-executable instructions for performing the method 
recited in claim 21. (Col 6 lines 57-60) 

As per claim 26, please see the discussion under claims 1 and 3 as they relate to 
the same subject matter. 

As per claim 35, please see the discussion under claims 3 and 13 under 
O'Flaherty et al. as they relate to the same subject matter. 

As per claim 36, please see the discussion under claims 4 and 13 under 
O'Flaherty et al. as they relate to the same subject matter. 
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As per claims 37 and 41 , O'Flaherty et al. discloses the system of claim 35 
wherein the consent menu; accessible through an interface (Figure 1 item 122) in which 
a user of data can specify the preferences as listed below; identifies a plurality of menu 
entries comprising: 

an identity of the client; allows override of customer's (Figure 1 item 110,112) 
preferences (Col 4 lines 34-41) 

a method by which the client seeks to access the item of user-specific 
information; read and write are the methods of access to the data (Col 5 lines 49-54) 

a purpose for which the client seeks to access the item of user-specific 
information. (Col 5 lines 15-17) 

As per claims 38 and 42, OTIaherty et al. discloses the system of claim 37 
wherein the plurality of menu entries further comprises a value proposition associated 
with the purpose for which the client desires to access the first item of user-specific 
information. (Col 5 lines 18-21) 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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Claims 13-15, 19 and 43-48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over O'Flaherty et al. (US 6,253,203) in view of Wong et al. (US 
2001/0042126). 

As per claims 13, O'Flaherty et al. discloses the method of claim 3 further 
comprising: updating an access control list associated with the one of the plurality of 
items of user-specific information for which the client lacked consent if the consent 
acceptance message indicates that the identified party granted consent, whereby upon 
updating said access control list, the client has consent to access the one of the plurality 
of items of user-specific information; The privacy rules database and security serve the 
same functions as the access control list, and the user can update the permissions. 
(Col 9 lines 66-67, Col 10 lines 1-6, Figure 1 items 152,154) 

O'Flaherty et al. does not disclose providing a consent acceptance message to 
the client. Wong et al. discloses providing a consent acceptance message being 
indicative of whether the identified party granted consent for the client to access the one 
of the plurality of items of user-specific information for which the client lacked consent; 
([001 1], [00501, Figure 5 items 510, 220c, Figure 6 items 614, 616) It would have been 
obvious to a person of ordinary skill in the art at the time the invention to include an 
consent acceptance message in the disclosure of O'Flaherty et al. because it allows to 
organize who is granted or denied what kind of access to the presence infomiation. 
[0046] 
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As per claim 14, OTIaherty et al. / Wong et al. discloses the method of claim 13 
and O'Flaherty et al. discloses further comprising removing the identified task from the 
task queue if the consent acceptance message indicates that the identified party 
granted consent. (Col 9 lines 16-20,Col 11 lines 38-43, Figure 4 item 402) 

As per claims 15 and 19, O'Flaherty et al./ Wong et al. discloses the method of 
claim 13 further comprising transmitting a consent success message to the client. 
O'Flaherty et al. fails to discloses said consent success message being indicative of 
whether the 

identified party granted consent for the client to access the one of the plurality of 
items of user-specific infomiation for which the client lacked consent. Wong et al. 
discloses said consent success message being indicative of whether the 

identified party granted consent for the client to access the one of the plurality of 
items of user-specific information for which the client lacked consent. ([001 1], [0050], 
Figure 5 items 510, 220c, Figure 6 item 214) It would have been obvious to a person of 
ordinary skill in the art at the time the invention to include an consent acceptance 
message of whether the identified party granted consent in the disclosure of O'Flaherty 
fbecause it allows to organize who is granted or denied what kind of access to the 
presence information. [0046] 

As per claim 43, O'Flaherty et al. discloses a method of controlling access to 
user-specific infomiation for use in connection with a network computing environment 
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including a web-services provider; A plurality of services is inherent to the data view 
suite (Figure 1 itenfis 102, 108) and allows for many services and profiles (Col 7 lines 1- 
15, Figure 2A) a user of a service provided by the web-services provider, and a client of 
the web-sen/ices provider, It is referred to the owner of the data (Col 4 lines 54-56, 
Figure 1 item 124) said web-services provider maintaining a data store of user-specific 
information associated with the user in connection with the service, (Col 3 lines 65-67, 
Figure 1 jtem 106) and said client seeking access to an item of user-specific information 
in the data store and transmitting an access request message directed to the service 
and indicating the item of user-specific information in the data store to which the client 
seeks access, (Col 1 1 lines 28-32) the method comprising: 
comparing the access request message to an access control list associated with the 
service, said access control list identifying whether the client has permission to access 
the item of user-specific information; (Col 4 lines 30-34, Col 1 1 lines 32-36, Col 1 1 lines 
51-59, Figure 1 item 108) The privacy rules database and security serve the same 
functions as the access control list (Figure 1 items 152,154) 

placing the access request in a pending request queue; (Col 1 1 lines 38-43, 
Figure 4 item 402) 

invoking a consent management system if the service response message 
received by the client indicates a fault; and ; It provides the means to invoke the consent 
management system because the user has control to update or change preferences via 
a client interface module and allows to monitor the use of personal data and send 
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receive alerts. (Col 4 lines 34-41, Col 5 lines 45-55, Col 11 lines 36-38, Col 4 lines 54- 
67, Col 5 lines 1-2, Figure 1 items 102, 114, 116, 122) 

filling the access request if the access control list authorizes the client to access 
the item of user-specific infonnation in the data store and removing the access request 
from the pending request queue. (Col 9 lines 16-20,Col 11 lines 38-43, Figure 1 items 
152,154, Figure 4 item 402) 

O'Flaherty et al. fails to discloses transmitting a service response 
message to the client indicating a fault or a success message. Wong et al. discloses 
transmitting a service response message to the client, said service response message 
indicating a fault if the access control list identifies that the client does not have 
permission to access the item of user-specific information and said service response 
message indicating a success if the access control list identifies that the client has 
permission to access the item of user-specific information; ([001 1], [0050], Figure 5 
items 510, 220c, Figure 6 items 614, 616) It would have been obvious to a person of 
ordinary skill in the art at the time the invention to transmit a service response message 
to a client in the disclosure of O'Flaherty et al. because it allows to organize who is 
granted or denied what kind of access to the presence information. [0046] 

As per claim 44, please see the discussion under claim 3 as it relates to the 
same subject matter. 
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As per claim 45, please see the discussion under claim 4 as it relates to the 
same subject matter. 

As per claim 46, please see the discussion under claim 5 as it relates to the 
same subject matter. 

As per claim 47, please see the discussion under claim 7 as it relates to the 
same subject matter. 

As per claim 48, please see the discussion under claim 20 as it relates to the 
same subject matter. 

Claim 16 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
OTIaherty et al. (US 6.253,203)/Wong et al. (US 2001/0042126) further in view of 
Numao et al. (US2001/0023421). 

As per claim 16, O'Flaherty et al. / Wong et al. discloses the method of claim 13. 
OTIaherty et al./ Wong et al. fails to discloses a time limit in which the client has 
consent to access the one of the plurality of items of user-specific information. Numao 
et al. discloses wherein updating the access control list further comprises setting a time 
limit in which the client has consent to access the one of the plurality of items of user- 
specific information. ([0125]). It would have been obvious to a person of ordinary skill 
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in the art at the time the invention to include a time limit for accessing user-specific 
information in the disclosure of O'Flaherty et al. because it allows for the information to 
be strictly controlled. ([01 25]) 

Claims 17 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over O'Flaherty et al. (US 6,253.203) in view of Hillis et al. (2003/0196094) 

As per claims 17 and 31 , O'Flaherty et al. discloses the method of claim 3 
wherein displaying the consent menu to the identified party (Figure 1 item 122) 
however, fails to discloses displaying an invitation to allow the client enjoy a one-time 
only access to the one of the plurality of items of user-specific infomnation. It would 
have been obvious to a person of ordinary skill in the art at the time the invention to 
allow the client to enjoy a one-time only access to infomiation in the disclosure of 
O'Flaherty et al. because it allows to determine the users levels of authorization with 
regard to the infomiation desired. ([0364]). 

Claim 24 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
O'Flaherty et al. (US 6,253,203) in view of Numao et al. (US2001/0023421). 

As per claim 24, O'Flaherty discloses the method of claim 21 and both the fii^t 
item of user-specific information and the second item of user-specific information; The 
second service is inherent to the data view suite (Figure 1 Items 102, 108) and allows 
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for many services and profiles (Col 7 lines 1-15, Figure 2A) O'Flaherty fails to disclose 
filling the second access request only if the client has consent to access both the first 
item of user-specific information and the second item of user-specific information. 
Numao et al. discloses further comprising filling the second access request only if the 
client has consent to access both the first item of user-specific information and the 
second item of user-specific information. ([0075]) It would have been obvious to a 
person of ordinary skill in the art at the time the invention to fill the second access 
request in the disclosure of O'Flaherty because it allows for the right to access 
information in a specific condition ([0066], Figure 6 item) and allows for the information 
to be strictly controlled. ([0125]) 



Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. O'Flaherty et al. (US 6,275,824) discloses a database 
management system, for storing and retrieving data from a plurality of database tables 
wherein the data in the database tables is controllably accessible according to privacy 
parameters stored in the database table. O'Flaherty et al. (US 6,631 ,361) discloses a 
method and apparatus for providing explanations of automated decisions applied to 
user data. Veldhuisen (US 6,480,850) discloses a method and apparatus for managing 
consumer notification and access and a means of correction and change of preferences 
for privacy or data protection in a data warehousing system including a physically 
separate but dependently connected data mart. Itabashi et al. (US 6,482,752) discloses 
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allowing a user to receive the provision of information in a simple and low-cost manner 
from any location in the communication environment. Bleizeffer (US 2002/0188572) 
discloses an interface for creating privacy policies for the P3P specification. Juels (US 
2002/0026345) discloses a targeted delivery of informational content with privacy 
protection. Blasko (US 2001/0049620) discloses a privacy protected targeted system. 
Morti (US2002/00 19828) discloses a computer-implemented method and apparatus for 
obtaining permission based data. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chirag R. Patel whose telephone number is (571)272- 
7966. The examiner can normally be reached on Monday to Friday from 7:30AM to 
4:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached on (571) 272-3880. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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